The widespread proliferation of embedded devices across many critical sectors has made them prime targets for exploitation, creating a clear need for practical firmware forensics with industrial focus. The methodology enables analysis of complex embedded systems, focusing on adaptability and efficiency when time-sensitive analysis is required, and is intended for a broad technical audience. This article (1) introduces hardware-focused forensic methodology for embedded firmware extraction, (2) provides an approach for rapid interface identification via instrumentation taxonomy, and (3) establishes reproducibility criteria for the presented firmware extraction process. By bridging digital forensics with hardware reverse engineering, investigators can efficiently extract and analyze the underlying system data to recover forensic evidence via accessing standardized debugging ports and interacting directly with physical memory chips. The outlined techniques not only encompass both non-destructive and destructive approaches, but also highlight best practices while documenting the extractions for forensic integrity. These presented methods will enable investigators to systematically extract firmware without requiring deep hardware-specific expertise, providing crucial capabilities for uncovering malicious activity and supporting incident response.

While Urban Air Mobility (UAM) field offers significant societal benefits for small-scale, high-speed urban transport, the use of unmanned aerial vehicles (UAV) presents challenges due to the use of software autonomy. UAM is safety-critical due to life-threatening consequences of failure, and thus the autonomous software used in UAM deployment must undergo robust performance verification and hazard assessment at both design time and runtime. We present a technique for full-system runtime safety assurance called pervasive monitoring, which utilizes a wide range of monitors at each layer of the system in order to provide a holistic view of hazard emergence. A major aspect of pervasive monitoring is context-awareness, or the ability of the monitors to respond to environmental and other external effects on the vehicle; this is demonstrated through a framework for a context-aware monitoring subsystem that utilizes Bayesian inference techniques. We also present methods for mass generation of standard monitors for runtime verification as well as updates to a UAV simulation testbed to provide hardware-in-the-loop verification and validation for the monitoring subsystems. Finally, we discuss an experimental plan for demonstrating the behavior of the pervasive monitoring system as a whole.

In this paper, we present a framework for creating and performing fault injection campaigns within an urban air mobility (UAM). Fault injection is a technique by which a process or data stream is intentionally altered with the aim of exposing some hazard in a system. Our process begins with System-Theoretic Process Analysis (STPA), passes the uncovered causes of failures for injection into communication streams as faults, and stores the data collected from the system. The fault injection framework presented here leverages and integrates with prior work on a simulation platform for activities supporting validation of runtime monitoring efforts in the UAM setting. Robot Operating System 2 (ROS 2) is the communication layer in the simulation testbed at which faults are introduced to the communication streams that are the inputs to software monitors. Results from two fault injection experiments are presented that demonstrate the ability of our framework to provide insight into monitors' behavior and the boundaries of their correct operation.

With the increasing prevalence of UAVs in the airspace, the reliability of such systems is more important than ever. In complex Cyber-Physical Systems (CPS) like UAV Flight Control Systems (FCS), static verification of all of the system software may be impractical due to the significant amount of code increasing the difficulty of verification. Monitoring the execution of the FCS and other CPS at runtime on a UAV can allow for violations of software specifications to be detected in a timely fashion, so that any mitigation strategies can be employed. Even in cases where there is no present mitigation strategy, runtime execution monitoring will allow such violations to be observed and logged that may have been missed during testing, so that they can be fixed by the maintainers. A method of monitoring the software execution of a CPS is presented, where the CPS code is instrumented in a lightweight way that emits events containing a thread and event ID during execution. A run-time monitor processes these events using regular expression-based specifications in real time to detect violations of execution specifications.

Urban Air Mobility (UAM) is an emerging transport solution for passengers or cargo at lower altitudes within urban and suburban areas using electric Vertical Take-off and Landing (eVTOL) air vehicles. The complexity of UAM technology strains design-time safety-assurance methods, which is driving the use of dynamic monitoring methods such as runtime verification to ensure safety of intended functionality (SOTIF). Although cyber-physical system (CPS) testing and design-assurance literature exists [1], there is little focus on UAM testbed concepts that evaluate runtime safety assurance. Such testbeds would help ensure safety coverage across a range of failure scenarios. In this paper, we present a new testbed architecture that systematically integrates formal runtime verification methods and tools into an Unmanned Aerial Vehicle (UAV) flight simulator. The value of this testbed is to help evaluate and transition in-time hazard detection and mitigation methods (in realistic operational contexts) to higher levels of technology maturity. To the best of our knowledge this is the first testbed that integrates formal runtime verification tools into a eVTOL simulation testbed.

Advanced Air Mobility (AAM) and Urban Air Mobility (UAM) are emerging concepts that capitalize on urban airspace for commercial transportation of passengers and cargo as well as augment surface transportation infrastructure. A major part of the solution towards achieving the UAM/AAM vision will be assured and trusted autonomy that enable human operators and passengers to interact with autonomous systems that transport humans and cargo with high assurance of safety, security and reliability. Given the complex interactions among the autonomy algorithms, human, environment and UAM control, there is a need for vehicle-level monitoring that detects emerging hazard scenarios. The data gathered from UAM systems that would help detect emerging hazards will be diverse: from highly-regular information (onboard flight controls) to irregular streaming information (weather, real time population dynamics). This paper presents a systematic approach for developing model- and data-driven hazard monitoring framework which we call pervasive monitoring. The aim of pervasive monitoring is to “comprehensively" observe a Cyber Physical System (CPS) at different architectural levels to ensure its safety and security with respect to its intended operation. Since there is no single monitor type that solves complex in-time hazard detection problems for UAM, we assert that several classes of monitors are needed to address this challenge. In this paper, we present a methodology based on STPA that partitions the UAM hazard monitoring challenge into two problems: a context monitoring problem and vehicle monitoring problem. We present preliminary results on deriving monitors from STPA, and realization of the monitors using the NASA Runtime Verification language Co-pilot.

Runtime verification or runtime monitoring equips safety-critical cyber-physical systems to augment design assurance measures and ensure operational safety and security. Cyber-physical systems have interaction failures, attack surfaces, and attack vectors resulting in unanticipated hazards and loss scenarios. These interaction failures pose challenges to runtime verification regarding monitoring specifications and monitoring placements for in-time detection of hazards. We develop a well-formed workflow model that connects system theoretic process analysis, commonly referred to as STPA, hazard causation information to lower-level runtime monitoring to detect hazards at the operational phase. Specifically, our model follows the DepDevOps paradigm to provide evidence and insights to runtime monitoring on what to monitor, where to monitor, and the monitoring context. We demonstrate and evaluate the value of multilevel monitors by injecting hazards on an autonomous emergency braking system model.

Runtime verification (RV) has the potential to enable the safe operation of safety-critical systems that are too complex to formally verify, such as Robot Operating System 2 (ROS2) applications. Writing correct monitors can itself be complex, and errors in the monitoring subsystem threaten the mission as a whole. This paper provides an overview of a formal approach to generating runtime monitors for autonomous robots from requirements written in a structured natural language. Our approach integrates the Formal Requirement Elicitation Tool (FRET) with Copilot, a runtime verification framework, through the Ogma integration tool. FRET is used to specify requirements with unambiguous semantics, which are then automatically translated into temporal logic formulae Ogma generates monitor specifications from the FRET output, which are compiled into hard-real time C99. To facilitate integration of the monitors in ROS2, we have extended Ogma to generate ROS2 packages defining monitoring nodes, which run the monitors when new data becomes available, and publish the results of any violations. The goal of our approach is to treat the generated ROS2 packages as black boxes and integrate them into larger ROS2 systems with minimal effort.